Vulnerabilidades de Hassantafreshi
CVEs publicadas que afetam produtos de Hassantafreshi: 4 registro(s), com severidade, exploração e correções.
CVE-2026-42747
Crítica · 9.3
CWE-89 27/05/2026
Plugin Easy Form Builder para WordPress - SQL Injection cega (CWE-89)
Neutralização imprópria de elementos especiais usados em um comando SQL ('SQL Injection') na vulnerabilidade do hassantafreshi Easy Form Builder easy-form-builder permite SQL Injection cego. Este problema afeta Easy Form Builder: de n/a até <= 4.0.6.
CVE-2025-14067
Média · 5.3
CWE-862 14/02/2026
Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure
The Easy Form Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive form response data, including messages, admin replies, and user information due to a logic error in the authorization check that uses AND (&&) instead of OR (||).
CVE-2026-22472
Média · 4.3
CWE-862 22/01/2026
WordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.9.6.
CVE-2025-67577
Média · 5.3
CWE-862 09/12/2025
WordPress Easy Form Builder plugin <= 3.8.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.